CVE-2020-11853

Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code.

CVSS v3.0 8.8 HIGH
CVSS v2.0 6.5 MEDIUM

8.8^/10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://softwaresupport.softwaregrp.com/doc/KM03747658	Vendor Advisory
https://softwaresupport.softwaregrp.com/doc/KM03747949	Vendor Advisory
https://softwaresupport.softwaregrp.com/doc/KM03747948	Vendor Advisory
https://softwaresupport.softwaregrp.com/doc/KM03747950	Vendor Advisory
https://softwaresupport.softwaregrp.com/doc/KM03749879	Vendor Advisory
https://softwaresupport.softwaregrp.com/doc/KM03747657	Vendor Advisory
https://softwaresupport.softwaregrp.com/doc/KM03747854	Vendor Advisory
http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html	Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/161366/Micro-Focus-Operations-Bridge-Manager-Remote-Code-Execution.html	Exploit Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microfocus:operations_bridge_manager:2020.05:::::::*
	cpe:2.3:a:microfocus:operations_bridge_manager:2019.11:::::::*
	cpe:2.3:a:microfocus:operations_bridge_manager:2019.05:::::::*
	cpe:2.3:a:microfocus:operations_bridge_manager:2018.11:::::::*
	cpe:2.3:a:microfocus:operations_bridge_manager:2018.05:::::::*
	cpe:2.3:a:microfocus:operation_bridge_manager:10.11:::::::*
	cpe:2.3:a:microfocus:operation_bridge_manager:10.12:::::::*
	cpe:2.3:a:microfocus:operation_bridge_manager:10.60:::::::*
	cpe:2.3:a:microfocus:operation_bridge_manager:10.61:::::::*
	cpe:2.3:a:microfocus:operation_bridge_manager:10.62:::::::*
	cpe:2.3:a:microfocus:operation_bridge_manager:10.63:::::::*
	cpe:2.3:a:microfocus:operation_bridge_manager::::::::
	cpe:2.3:a:microfocus:operations_bridge_manager:2019.08:::::::*
	cpe:2.3:a:microfocus:operations_bridge_manager:2018.08:::::::*
	cpe:2.3:a:microfocus:operations_bridge_manager:2018.02:::::::*
	cpe:2.3:a:microfocus:operations_bridge_manager:2017.11:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:hp:universal_cmbd_foundation:10.20:::::::*
	cpe:2.3:a:microfocus:application_performance_management:9.50:::::::*
	cpe:2.3:a:microfocus:application_performance_management:9.40:::::::*
	cpe:2.3:a:microfocus:application_performance_management:9.51:::::::*
	cpe:2.3:a:microfocus:data_center_automation::::::::
	cpe:2.3:a:hp:universal_cmbd_foundation:2018.05:::::::*
	cpe:2.3:a:hp:universal_cmbd_foundation:2018.08:::::::*
	cpe:2.3:a:hp:universal_cmbd_foundation:2018.11:::::::*
	cpe:2.3:a:hp:universal_cmbd_foundation:2019.02:::::::*
	cpe:2.3:a:hp:universal_cmbd_foundation:2019.05:::::::*
	cpe:2.3:a:hp:universal_cmbd_foundation:2019.11:::::::*
	cpe:2.3:a:hp:universal_cmbd_foundation:2020.05.:::::::*
	cpe:2.3:a:hp:universal_cmbd_foundation:11.0:::::::*
	cpe:2.3:a:hp:universal_cmbd_foundation:10.30:::::::*
	cpe:2.3:a:hp:universal_cmbd_foundation:10.31:::::::*
	cpe:2.3:a:hp:universal_cmbd_foundation:10.32:::::::*
	cpe:2.3:a:hp:universal_cmbd_foundation:10.33:::::::*
	cpe:2.3:a:microfocus:hybrid_cloud_management::::::::
	cpe:2.3:a:microfocus:service_manager_automation:2020.02:::::::*
	cpe:2.3:a:microfocus:service_manager_automation:2020.05:::::::*

Information

Published : 2020-10-22 14:15

Updated : 2022-11-16 08:45

NVD link : CVE-2020-11853

Mitre link : CVE-2020-11853

JSON object : View

CWE

NVD-CWE-noinfo

Products Affected

microfocus

operations_bridge_manager
operation_bridge_manager
service_manager_automation
data_center_automation
application_performance_management
hybrid_cloud_management

universal_cmbd_foundation

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://softwaresupport.softwaregrp.com/doc/KM03747658", "name": "https://softwaresupport.softwaregrp.com/doc/KM03747658", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://softwaresupport.softwaregrp.com/doc/KM03747949", "name": "https://softwaresupport.softwaregrp.com/doc/KM03747949", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://softwaresupport.softwaregrp.com/doc/KM03747948", "name": "https://softwaresupport.softwaregrp.com/doc/KM03747948", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://softwaresupport.softwaregrp.com/doc/KM03747950", "name": "https://softwaresupport.softwaregrp.com/doc/KM03747950", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://softwaresupport.softwaregrp.com/doc/KM03749879", "name": "https://softwaresupport.softwaregrp.com/doc/KM03749879", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://softwaresupport.softwaregrp.com/doc/KM03747657", "name": "https://softwaresupport.softwaregrp.com/doc/KM03747657", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://softwaresupport.softwaregrp.com/doc/KM03747854", "name": "https://softwaresupport.softwaregrp.com/doc/KM03747854", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html", "name": "http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "refsource": "MISC"}, {"url": "http://packetstormsecurity.com/files/161366/Micro-Focus-Operations-Bridge-Manager-Remote-Code-Execution.html", "name": "http://packetstormsecurity.com/files/161366/Micro-Focus-Operations-Bridge-Manager-Remote-Code-Execution.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2020-11853", "ASSIGNER": "security@microfocus.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}}, "publishedDate": "2020-10-22T21:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:microfocus:operations_bridge_manager:2020.05:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microfocus:operations_bridge_manager:2019.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microfocus:operations_bridge_manager:2019.05:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microfocus:operations_bridge_manager:2018.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microfocus:operations_bridge_manager:2018.05:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microfocus:operation_bridge_manager:10.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microfocus:operation_bridge_manager:10.12:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microfocus:operation_bridge_manager:10.60:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microfocus:operation_bridge_manager:10.61:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microfocus:operation_bridge_manager:10.62:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microfocus:operation_bridge_manager:10.63:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microfocus:operation_bridge_manager:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "10.10"}, {"cpe23Uri": "cpe:2.3:a:microfocus:operations_bridge_manager:2019.08:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microfocus:operations_bridge_manager:2018.08:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microfocus:operations_bridge_manager:2018.02:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microfocus:operations_bridge_manager:2017.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:hp:universal_cmbd_foundation:10.20:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microfocus:application_performance_management:9.50:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microfocus:application_performance_management:9.40:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microfocus:application_performance_management:9.51:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microfocus:data_center_automation:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2019.11"}, {"cpe23Uri": "cpe:2.3:a:hp:universal_cmbd_foundation:2018.05:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:hp:universal_cmbd_foundation:2018.08:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:hp:universal_cmbd_foundation:2018.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:hp:universal_cmbd_foundation:2019.02:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:hp:universal_cmbd_foundation:2019.05:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:hp:universal_cmbd_foundation:2019.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:hp:universal_cmbd_foundation:2020.05.:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:hp:universal_cmbd_foundation:11.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:hp:universal_cmbd_foundation:10.30:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:hp:universal_cmbd_foundation:10.31:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:hp:universal_cmbd_foundation:10.32:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:hp:universal_cmbd_foundation:10.33:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microfocus:hybrid_cloud_management:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2020.05", "versionStartIncluding": "2018.05"}, {"cpe23Uri": "cpe:2.3:a:microfocus:service_manager_automation:2020.02:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microfocus:service_manager_automation:2020.05:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-11-16T16:45Z"}

8.8 /10